CVE-2026-63146

The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a PHP code injection flaw. The root cause involves unescaped, attacker-controlled values being written into the config.inc.php file via the File::updateConfigFile() and DbInstall::dbControl() functions during installation. ...